Jayanth Kumar Kannan and Jaeyeon Jung and Vern Paxson and Can Emre Koksal

EECS Department, University of California, Berkeley

Technical Report No. UCB/EECS-2005-30

December 19, 2005

http://www2.eecs.berkeley.edu/Pubs/TechRpts/2005/EECS-2005-30.pdf

Upon success, certain network attacks manifest by causing the victim host to change its network-visible connection ehavior, such as by starting a new service that the attacker probes to confirm success, ``phoning home'' to a host ontrolled by the attacker, or further propagating the attack (e.g., worms or spam relays). One characteristic of such change in network behavior is the presence of unusual causal relationships between connections. Based on this observation, we develop a statistical test that a network monitor can use to identify these causal relationships, and an accompanying set of filtering mechanisms to winnow down the full set of causal relationships to those that are unexpected. We evaluate our mechanism on two large Internet traces, finding that while its detection is incomplete (non-negligible false negatives), it unearths numerous instances of interesting activity. We also find that the rate of false alarms, while not low enough to enable automatic responses to intrusions, is only a few tens per day for a busy site that sees over 2.5~million connections a day.

---

BibTeX citation:

@techreport{Kannan:EECS-2005-30,
    Author= {Kannan, Jayanth Kumar and Jung, Jaeyeon and Paxson, Vern and Koksal, Can Emre},
    Title= {Detecting Hidden Causality in Network Connections},
    Year= {2005},
    Month= {Dec},
    Url= {http://www2.eecs.berkeley.edu/Pubs/TechRpts/2005/EECS-2005-30.html},
    Number= {UCB/EECS-2005-30},
    Abstract= {Upon success, certain network attacks manifest by causing the victim host to change its network-visible connection  ehavior, such as by starting a new service that the attacker probes to confirm success, ``phoning home'' to a host  ontrolled by the attacker, or further propagating the attack (e.g., worms or spam relays). One characteristic of such  change in network behavior is the presence of unusual causal relationships between connections. Based on this observation, we develop a statistical test that a network monitor can use to identify these causal relationships, and  an accompanying set of filtering mechanisms to winnow down the full set of causal relationships to those that are unexpected.  We evaluate our mechanism on two large Internet   traces, finding that while its detection is incomplete (non-negligible false negatives), it unearths numerous instances of interesting activity.  We also find that the rate of false alarms, while not low enough to enable automatic responses to intrusions, is only a few tens per day for a busy site that sees over 2.5~million connections a day.},
}

EndNote citation:

%0 Report
%A Kannan, Jayanth Kumar 
%A Jung, Jaeyeon 
%A Paxson, Vern 
%A Koksal, Can Emre 
%T Detecting Hidden Causality in Network Connections
%I EECS Department, University of California, Berkeley
%D 2005
%8 December 19
%@ UCB/EECS-2005-30
%U http://www2.eecs.berkeley.edu/Pubs/TechRpts/2005/EECS-2005-30.html
%F Kannan:EECS-2005-30